Loading story…
A malicious ZIP archive masquerading as the résumé of Zhang Yuguang, presented as a Beijing Institute of Technology network-engineering graduate, was used to target researchers interested in China’s defense-technology sector. Opening the lure resulted in deployment of VShell, a legitimate remote-access tool that can be abused as a backdoor, enabling remote control of compromised systems.
Reported infrastructure and artifacts include IP address 38.207.178.192, ports 50812 and 50813, and HTTP resources named EasyConnectUpdata_Log.txt and MySQL_LOG.txt. Defenders should investigate connections to that infrastructure and review endpoints for TEMPde.log, the string YtWzxwZimsZoeMen, and associated résumé-themed ZIP files; the available reporting does not attribute the campaign or identify confirmed victims.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
SOCRadar reported a SNOWLIGHT campaign that scanned more than 9,990 hostnames across 104 country-code domains and targeted government and commercial infrastructure in over 100 countries, with Taiwan as its principal target. The operators allegedly exploited exposed services including Apache Tomcat, cPanel/WHM, Confluence, Exchange ProxyShell, and WebLogic-class targets using staging infrastructure led by 130.94.17[.]180, first observed on 2026-06-09.
Reporting identified professors and laboratory personnel researching applied AI, electrical grids, and renewable energy as targets of the fake Zhang Yuguang résumé campaign. It also identified a likely intended recipient as an academic in mainland China, while noting that no operator or ultimate objective was established.
Researchers detailed that the fake resume executable performs anti-analysis checks, downloads encrypted SNOWLIGHT shellcode for in-memory execution, and receives a 4.65 MB payload that launches VShell. The report also published hashes for the loader, shellcode, encrypted response, and VShell payloads, and documented encrypted VShell registration with 38.207.178.192.
Researchers published observables tied to a ZIP archive purporting to be a Beijing Institute of Technology network-engineering graduate resume for Zhang Yuguang, including file hashes, 38.207.178.192, ports 50812 and 50813, and URLs for EasyConnectUpdata_Log.txt and MySQL_LOG.txt.
A malware-delivery campaign used a fake resume referencing China’s defense-technology sector as a social-engineering lure, resulting in installation of the VShell remote-access tool. No actor, victim, or affected organization was identified.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 37 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
9 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcereddit.com
Open sourceblog.himanshuanand.com
Open sourcesocradar.io
Open sourceunitracker.aspi.org.au
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported that a China-linked threat actor tracked as **DEV-0322** exploited **CVE-2021-40539** in vulnerable **Zoho ManageEngine ADSelfService Plus** servers to compromise organizations in the defense industrial base, higher education, consulting, and information technology sectors. The intrusions involved credential dumping, lateral movement, and the installation of a malicious **IIS** module that accepted commands through HTTP cookies, harvested authentication data into `key.dat`, and could deploy `ccc.exe` to run `cmd.exe` commands on infected systems. Additional reporting tied the activity to a broader post-exploitation toolset associated with **Godzilla**, **NGLite**, and **KdcSponge**, reinforcing that the attackers were focused on stealthy persistence and credential access after initial compromise. Microsoft also said the actor deployed **Trojan:Win64/Zebracon**, which used hardcoded credentials to access compromised **Zimbra** mail servers and retrieve commands through **SOAP** email operations, and published detections, hunting queries, and indicators of compromise to help defenders identify affected systems and follow-on activity.
Aug 15, 2026Trellix reported a Linux malware campaign that delivers **VShell** through a spam email carrying a RAR archive whose malicious logic is embedded in a crafted filename rather than the file's contents. The attack is triggered when unsafe shell scripting patterns interpret that filename through expansion and commands such as `eval`, `echo`, `printf`, or logging routines, causing a Base64-decoded Bash downloader to run. The downloader fingerprints the victim's CPU architecture, retrieves an ELF loader from `47.98.194.60`, and attempts stealthy execution with `nohup` from writable directories. The ELF loader then contacts a hardcoded command-and-control server, receives an XOR-encrypted payload using key `0x99`, decrypts it in memory, and launches the final malware with `fexecve()` while disguising itself as a kernel worker thread such as `[kworker/0:2]`. Trellix said the initial stage aligns with **Snowlight** dropper activity and identified the final payload as **VShell**, a Go-based Linux backdoor linked primarily to Chinese APT operations. The infection chain is notable for remaining effectively fileless after download, supporting multiple CPU architectures, and evading defenses that do not inspect filenames or in-memory execution behavior.
Jun 29, 2026
Security researchers reported multiple campaigns using trojanized versions of **PuTTY** and other legitimate tools to compromise high-value users, including administrators, engineers, and technical support staff. LevelBlue said a recent malvertising operation pushed fake PuTTY installers through **Bing sponsored ads** and typosquatted domains such as `puttyy[.]org` and `puttysystems[.]com`, with a signed malicious executable creating scheduled-task persistence, dropping `twain_96.dll` and `green.dll`, and communicating with infrastructure linked to **Broomstick/Oyster** malware. In affected environments, the intrusions progressed to hands-on-keyboard activity, reconnaissance via `cmd.exe`, and **Kerberoasting** using an in-memory script derived from PowerSploit’s `Invoke-Kerberoast` to obtain RC4-HMAC Kerberos service tickets for offline cracking. Microsoft previously described a related tradecraft pattern in which North Korean state-backed **ZINC**—now tracked as **Diamond Sleet**—used social engineering on LinkedIn and WhatsApp to deliver weaponized open-source software, including **PuTTY**, **KiTTY**, **TightVNC Viewer**, **Sumatra PDF Reader**, and **muPDF**, to targets in media, defense, aerospace, and IT services across several countries. That activity deployed the **ZetaNile** malware family using DLL search-order hijacking, staged payloads, persistence, lateral movement, and data exfiltration, while separate analysis of Lazarus-linked **BLINDINGCAN** showed the group’s broader capability set for encrypted command-and-control, remote command execution, file transfer, and system discovery. Together, the reporting shows attackers repeatedly abusing trusted admin and open-source tools as malware delivery vehicles to gain persistence, steal credentials, and expand access inside victim networks.
Aug 15, 2026